Rodriguez v. Fastmed Urgent Care, Inc.

2025 NCBC 15

• Court: North Carolina Business Court
• Decided: March 25, 2025
• Docket: 24-CVS-8555
• Status: Published

Opinion

Rodriguez v. FastMed Urgent Care, Inc., 2025 NCBC 15.

STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE SUPERIOR COURT DIVISION DURHAM COUNTY 24CV008555-310

JACKELYN RODRIGUEZ,

Plaintiff,

v. ORDER AND OPINION ON DEFENDANT’S MOTION TO DISMISS FASTMED URGENT CARE, INC. f/k/a FASTMED URGENT CARE, P.C.,

Defendant.

THIS MATTER is before the Court on Defendant FastMed Urgent Care, Inc.’s

(“FastMed”) Motion to Dismiss (“Motion to Dismiss,” or the “Motion,” ECF No. 14).

Having considered the Motion, the parties’ briefs, the arguments of counsel, the

applicable law, and all other appropriate matters of record, the Court concludes that

the Motion to Dismiss should be DENIED in part and DISMISSED as moot in

part for the reasons set forth below.

The Gibbons Law Group, LLC by Philip J. Gibbons and Corey Michael Stanton; and Stephan Zouras LLC by David J. Cohen, James B. Zouras, Michael Casas, and Teresa M. Becvar for Plaintiff Jackelyn Rodriguez.

Nelson Mullins Riley & Scarborough LLP by Joseph Matthew Gorga, Nathaniel Pencook, and Candace Friel for Defendant FastMed Urgent Care, Inc.

Davis, Judge.

INTRODUCTION

1. In this case, the plaintiff alleges that her medical provider secretly

embedded third-party technology on its website that collected and transmitted her confidential information to a third party without her consent. The present Motion

requires the Court to address (1) whether North Carolina law imposes upon

healthcare providers a common law duty to protect their patients’ private information

from unauthorized disclosure; and (2) the pleading requirements for alleging injuries

flowing from such conduct.

FACTUAL AND PROCEDURAL BACKGROUND

2. The Court does not make findings of fact in connection with a motion to

dismiss under Rule 12(b)(6) of the North Carolina Rules of Civil Procedure and

instead recites those facts contained in the complaint and in documents attached to,

referred to, or incorporated by reference in the complaint that are relevant to the

Court’s determination of the motion. See, e.g., Window World of Baton Rouge, LLC

v. Window World, Inc., 2017 NCBC LEXIS 60, at *11 (N.C. Super. Ct. July 12, 2017).

3. At the heart of this lawsuit are two pieces of technology developed by

Meta Platforms, Inc. (“Meta”)—the Pixel and the Conversions Application

Programming Interface (“CAPI,” and together with the Pixel, the “Business Tools”).

(Compl. ¶¶ 13, 19–21.) They were designed—as a part of Meta’s advertising

business—to collect data from people who visit websites or open mobile applications

(“Users”) and then transmit that data to Meta for analysis. (Compl. ¶¶ 9–10, 25.)

4. Once integrated into a website or server, the Business Tools are

“executed in the background,” meaning that they can operate on a website or in a

mobile application without ever alerting the User of their presence. (Compl. ¶¶ 15–

16, 39–41.) Further, because of how the Business Tools were designed, they are able to collect, store, and transmit User data in ways that cannot be blocked by traditional

“ad blocker” software or by a User refusing to give their consent for their data to be

collected. (Compl. ¶¶ 18, 22, 42.)

5. Using the data collected by the Business Tools, Meta is able to connect

the User’s data to her “real-world identity” by linking her data to the User’s Facebook

account. (Compl. ¶¶ 51–53, 55–56.)1

6. Once Meta has connected the User’s data to her real-world identity,

Meta allegedly processes, analyzes, and assimilates the data so that it can be sold to

online advertisers. (Compl. ¶¶ 55, 57, 81, 121.)

7. These online advertisers—equipped with personally-identifiable User

data—are then able to create marketing campaigns that focus or “target” their

advertisements toward specific Users. (Compl. ¶¶ 25, 27, 30–33, 55, 81.)

8. FastMed is an integrated healthcare provider/payer system that is

based in Durham County, North Carolina and operates dozens of medical clinics

throughout the State. (Compl. ¶ 2.)

9. As part of its business, FastMed operates a publicly available website

(the “Website”) and a password-protected patient portal called MyChart (“MyChart,”

together with the Website, the “Web Properties”). (Compl. ¶ 2.)

1 The Complaint alleges that if the User does not have a Facebook account, Meta will nonetheless create a “shadow account” to aggregate the User’s data for later identification. (Compl. ¶ 56.) 10. FastMed’s Website allows Users to schedule appointments, locate

FastMed providers, and find information on specific health conditions, treatments,

and medications. (Compl. ¶ 127.)

11. Through MyChart, FastMed’s patients are able to enter and view a

variety of sensitive information, including messages with their healthcare providers,

test results, their medications, “health reports,” “medical history,” “plan of care,”

health summaries, and billing summaries. (Compl. ¶¶ 44, 125.) MyChart also

enables patients to schedule healthcare visits and message their providers directly.

(Compl. ¶ 125.)

12. Plaintiff Jackelyn Rodriguez is a resident of North Carolina. (Compl. ¶

1.) She opened a Facebook account prior to 2009 and has actively maintained it since

that time. (Compl. ¶ 1.)

13. Starting around 2015, Plaintiff began seeking medical treatment from

FastMed. (Compl. ¶ 1.)

14. As a patient, Plaintiff has used the Web Properties to facilitate her care

by messaging her providers, scheduling appointments, finding FastMed office

locations, reviewing her medications, viewing doctors’ notes, and searching for

information on her various medical conditions and treatments. (Compl. ¶¶ 1, 125.)

15. Plaintiff alleges that after becoming a patient, FastMed surreptitiously

integrated the Business Tools into its Web Properties and servers. (Compl. ¶¶ 19,

26, 43, 46–58, 120.) 16. As a result, Plaintiff contends that FastMed—without her knowledge or

consent—collected and transmitted her confidential information to Meta, including

information regarding her appointments with FastMed providers, her health

conditions, and her insurance information. (Compl. ¶¶ 125–30.)

17. In addition, Plaintiff alleges that—unbeknownst to her—Meta and

FastMed disclosed her private information to online advertisers. (Compl. ¶¶ 121,

131.) As a result, Plaintiff has been subjected to targeted online advertisements

“focused” on her private FastMed patient information. (Compl. ¶¶ 121, 131.)

18. On 25 July 2023, Plaintiff filed a putative class action lawsuit in the

United States District Court for the Eastern District of North Carolina against

FastMed asserting various claims for monetary relief. See Rodriguez v. FastMed

Urgent Care, P.C., 741 F. Supp. 3d 352 (E.D.N.C. 2024).

19. The federal court dismissed the only federal claim asserted in her

complaint and declined to exercise supplemental subject matter jurisdiction over her

remaining state-law claims. Id.

20. On 24 September 2024, Plaintiff filed the present Complaint in Durham

County Superior Court asserting claims for violation of the North Carolina Electronic

Surveillance Act (“NCESA”) under N.C.G.S. § 15A-286 along with claims for

negligence per se, common law negligence, and invasion of privacy by intrusion upon

seclusion. (ECF No. 3.)

21. The Complaint states that Plaintiff seeks to assert her claims against

FastMed on behalf of herself and a putative class of “[a]ll residents of North Carolina who used FastMed’s Web Properties and had Private Information about their past,

present, or future health conditions shared with Meta without their notice or

consent[]” pursuant to Rule 23(a) of the North Carolina Rules of Civil Procedure.

(Compl. ¶ 137.)

22. On 5 November 2024, this case was designated as a mandatory complex

business case and assigned to the undersigned. (ECF Nos. 1–2.)

23. FastMed filed the present Motion to Dismiss on 9 December 2024

seeking dismissal of all of Plaintiff’s claims.

24. The Court held a hearing on the Motion on 5 March 2025 at which all

parties were represented by counsel.

25. Having been fully briefed, the Motion is now ripe for resolution.

LEGAL STANDARD

26. In ruling on a motion to dismiss under Rule 12(b)(6), the Court may only

consider the complaint and “any exhibits attached to the complaint,” Krawiec v.

Manly, 370 N.C. 602, 606 (2018), in order to determine whether “as a matter of law,

the allegations of the complaint, treated as true, are sufficient to state a claim upon

which relief can be granted under some recognized legal theory,” Forsyth Mem’l

Hosp., Inc. v. Armstrong World Indus., Inc., 336 N.C. 438, 442 (1994) (cleaned up).

The Court must view the allegations in the complaint “in the light most favorable to

the non-moving party.” Christenbury Eye Ctr., P.A. v. Medflow, Inc., 370 N.C. 1, 5

(2017) (cleaned up). 27. “It is well established that dismissal pursuant to Rule 12(b)(6) is proper

when ‘(1) the complaint on its face reveals that no law supports the plaintiff’s claim;

(2) the complaint on its face reveals the absence of facts sufficient to make a good

claim; or (3) the complaint discloses some fact that necessarily defeats the plaintiff’s

claim.’” Corwin v. British Am. Tobacco PLC, 371 N.C. 605, 615 (2018) (quoting Wood

v. Guilford Cnty., 355 N.C. 161, 166 (2002)).

ANALYSIS

28. As an initial matter, Plaintiff stated in her brief in response to

FastMed’s Motion that she is not proceeding on her claim for violation of the NCESA

or her claims for negligence per se or invasion of privacy by intrusion upon seclusion.

(Pl.’s Br., ECF No. 19, at 2 n.1.)

29. At the 5 March hearing, Plaintiff’s counsel confirmed that Plaintiff has

agreed to voluntarily dismiss those claims with prejudice and that she will be

proceeding solely on her claim for common law negligence.

30. Accordingly, the claims in the Complaint for violation of the NCESA,

negligence per se, and invasion of privacy by intrusion upon seclusion are

DISMISSED with prejudice.

31. Therefore, the only arguments made by FastMed that the Court must

address are those dealing with Plaintiff’s claim for common law negligence.

I. Existence of a Legal Duty

32. Negligence is defined as the “failure to exercise proper care in the

performance of some legal duty which the defendant owed the plaintiff, under the circumstances in which they were placed.” Wood v. Guilford Cnty., 355 N.C. 161, 166

(2002) (cleaned up). “To state a common law negligence claim, plaintiff must show

(1) a legal duty; (2) a breach thereof; and (3) injury proximately caused by the breach.”

Bridges v. Parrish, 366 N.C. 539, 541 (2013) (cleaned up).

33. In support of its Motion seeking dismissal of Plaintiff’s claim for common

law negligence, FastMed asserts that Plaintiff has failed to establish any legal duty

that FastMed owed its patients with regard to maintaining the privacy of their health

information. In response, Plaintiff contends that our Court of Appeals has expressly

recognized such a duty in two cases—Acosta v. Byrum, 180 N.C. App. 562 (2006), and

Demarco v. Charlotte-Mecklenburg Hosp. Auth., 268 N.C. App. 334 (2019).

34. This Court addressed this identical issue in Weddle v. WakeMed Health

& Hosps., 2023 NCBC LEXIS 162 (N.C. Super. Ct. Dec. 4, 2023).

35. In Weddle, the plaintiffs were current and former patients of the

WakeMed Health and Hospitals (“WakeMed”) system. Id. at *3. They alleged that

WakeMed had, without their knowledge or consent, embedded Meta’s Pixel

technology in its public-facing website and patient portal. Id. at *2–3. As a result,

the plaintiffs claimed, WakeMed regularly shared their confidential information with

Meta—including their contact information, medical history, and appointment

calendar—without their knowledge or consent. Id. at *2.

36. In rejecting WakeMed’s argument that the plaintiffs had failed to allege

the existence of a legal duty that had been breached, this Court stated the following: WakeMed argues that North Carolina law does not recognize a duty of care in these circumstances. Not so. “It is well established that hospitals and doctors in their employ owe their patients a duty to exercise the degree of care that a reasonable person would in similar circumstances to prevent an unreasonable risk of harm to their patients.” Demarco, 268 N.C. App. at 338. Our courts have applied that “general duty of reasonable care” in proper circumstances to the maintenance and dissemination of patient records. Id. at 339; see also Acosta, 180 N.C. App. at 568 (holding that plaintiff had adequately alleged the existence of a “duty to maintain privacy in her confidential medical records”).

...

Nor did the Court of Appeals apply the wrong standard of review in Acosta and Demarco. WakeMed misreads those cases to allow a plaintiff to give “notice of a theory of duty” even if that duty is not one “recognized under the law.” (Br. Supp. 7, ECF No. 60.) But courts do not indulge futile claims. In both cases, the Court of Appeals held that the plaintiffs had stated valid claims for relief and had properly pointed to “HIPAA, its implementing regulations, and hospital privacy policies . . . to plead a specific standard of care sufficient to overcome dismissal under Rule 12(b)(6).” Demarco, 268 N.C. App. at 339; see also Acosta, 180 N.C. App. at 568. Plaintiffs in this case have done the same.

Weddle, 2023 NCBC LEXIS 162, at *8–9.

37. Thus, in rejecting the same argument FastMed is making here, this

Court in Weddle construed Acosta and Demarco as recognizing the very type of duty

Plaintiff has alleged in her Complaint.

38. Although FastMed emphasizes the existence of certain differences

between the facts of those cases and the facts alleged here, its argument misses the

forest for the trees. In both cases, our Court of Appeals unambiguously recognized

that healthcare providers owe a general duty of care to patients regarding the

maintenance of their confidential information. See Demarco, 268 N.C. App. at 338–

39 (holding that healthcare providers “owe their patients a duty to exercise the degree of care that a reasonable person would in similar circumstances to prevent an

unreasonable risk of harm” (cleaned up)); Acosta, 180 N.C. App. at 568 (holding that

the plaintiff had sufficiently alleged a duty of care to protect her healthcare

information and that “the rules and regulations of the University Health Systems,

Roanoke Chowan Hospital, and HIPAA” would inform the standard of care).

39. Moreover, at the 5 March hearing, FastMed’s counsel conceded that

Acosta and Demarco are the only cases from North Carolina’s appellate courts that

have addressed this issue.

40. The Court fully agrees with the analysis in Weddle regarding the duty

of healthcare providers to maintain the confidentiality of their patients’ personal

information. As in Weddle, the Complaint filed by Plaintiff here adequately alleges

a common law duty existing under North Carolina law and the breach thereof.

II. Sufficiency of Allegations of Injury

41. FastMed’s remaining arguments concern the adequacy of Plaintiff’s

allegations of injury stemming from its breach and the resulting damages to which

she is entitled to recover.

42. In her Complaint, Plaintiff states the following on this subject:

By engaging in the conduct alleged herein, FastMed directly and proximately caused Plaintiff . . . to suffer actual harm and damages that include:

a. a loss in the value of [her] Private Information;

b. embarrassment, humiliation, emotional harm, and distress because of the unauthorized transmission and commercial use of [her] Private Information; c. being deprived of the full value of healthcare services for which [she] paid, which included a duty to maintain the confidentiality of [her] patient information;

d. being deprived of a proportional share of the value Meta paid Defendant to gain access to [her] Private Information for its commercial use; and

e. being deprived of a proportional share of the value Defendant gained by putting [her] Private Information to its commercial use.

(Compl. ¶ 169.)

43. Broadly speaking, these alleged damages fall into two categories: (1)

emotional distress injury and (2) economic injury. The Court will address each in

turn.

A. Emotional Distress

44. As quoted above, Plaintiff describes her emotional distress damages as

“embarrassment, humiliation, emotional harm, and distress” resulting from

FastMed’s allegedly improper disclosure and use of her personal health-related

information.

45. FastMed asserts that such allegations lack sufficient detail under Rule

12(b)(6). However, FastMed fails to cite any North Carolina case law holding that

claimed damages for emotional harm stemming from common law negligence must

be pled with greater specificity.

46. To the contrary, North Carolina case law makes clear that no

heightened pleading requirement exists in this context and that such claims must

only meet the low bar of notice pleading. See, e.g., Iadanza v. Harper, 169 N.C. App.

776, 780 (2005) (rejecting an argument that “emotional suffering” resulting from common law negligence must meet a heightened standard of “severe emotional

distress”); Royster v. McNamara, 218 N.C. App. 520, 530–33 (2012) (finding

allegations that plaintiff “[was] forced to undergo humiliation and emotional damage”

to be sufficient in connection with a negligence claim); see also Demarco, 268 N.C.

App. at 341–42 (noting that “[a]n allegation of damages is sufficient under Rule

12(b)(6) so long as it provides the defendant notice of the nature and basis of [the]

plaintiff’s claim so as to enable him to answer and prepare for trial” (cleaned up)).

47. Therefore, FastMed’s Motion to Dismiss as to Plaintiff’s claim for

emotional distress damages is DENIED.

B. Economic Damages

48. With regard to the economic damages referenced in the Complaint,

FastMed argues that they are barred by North Carolina’s economic loss rule.

49. “The economic loss rule, as it has developed in North Carolina, generally

bars recovery in tort for damages arising out of a breach of contract[.]” Rountree v.

Chowan Cnty., 252 N.C. App. 155, 159 (2017) (cleaned up). It “denote[s] limitations

on the recovery in tort when a contract exists between the parties that defines the

standard of conduct and which the courts believe should set the measure of recovery.”

Akzo Nobel Coatings, Inc. v. Rogers, 2011 NCBC LEXIS 42, at *47–48 (N.C. Super.

Ct. Nov. 3, 2011).

50. In relying upon the economic loss rule, FastMed asserts that because its

entire relationship with Plaintiff was contractual, her economic damages would be

recoverable only in connection with a breach of contract claim. 51. However, this Court has previously recognized that the economic loss

rule does not bar a tort claim where an independent duty exists under the law that is

not premised on an existing contract between the parties.

[T]o avoid the reach of the economic loss rule, “a plaintiff must allege a duty owed to him by the defendant [that is] separate and distinct from any duty owed under a contract.” Akzo Nobel Coatings, Inc., 2011 NCBC LEXIS 42, at *48. As this Court has previously observed, in determining whether the economic loss rule bars a negligence claim, “the true question the Court must answer is whether [the defendant owed the plaintiff] a duty of care to avoid causing [the plaintiff] purely economic loss.” Crescent Univ. CityVenture, LLC v. AP Atl., Inc., 2019 NCBC LEXIS 49, at *42 (N.C. Super. Ct. Aug. 14, 2019).

Johnson Bros. Corp. v. City of Charlotte, 2024 NCBC LEXIS 33, at *7 (N.C. Super.

Ct. Feb. 27, 2024).

52. The Court notes that the United States District Court for the Middle

District of North Carolina has recently rejected a defendant’s argument seeking

application of the economic loss rule under circumstances similar to those existing

here. See Williams v. DukeHealth, 2024 U.S. Dist. LEXIS 58377 (M.D.N.C. Mar. 1,

2024).

53. In Williams, the court stated the following:

[T]he Amended Complaint alleges that, in addition to contractual obligations to protect patients’ health data privacy, Defendant had a duty of care to protect Plaintiff’s privacy in her medical records and that HIPAA, among other statutes, informed that standard of care. (Am. Compl. ¶¶ 33–44, 166–178.) See also Demarco, 268 N.C. App. at 339; Acosta, 180 N.C. App. at 568; Weddle, 2023 NCBC LEXIS 162, at *4. As mentioned in the discussion of Plaintiff’s breach of contract claim, the extent to which Defendant’s purported duty to Plaintiff arose under a general duty of care, or HIPAA, or the contract exclusively, or neither, will be more appropriately addressed with the development of the record. See Farley v. Eye Care Leaders Holdings, LLC, 2023 U.S. Dist. LEXIS 15480, at *5 (M.D.N.C. Jan. 31, 2023) (unpublished) (plaintiffs “met the minimal standard of plausibility for each of their claims” in data breach case and “[a]ny weaknesses of those claims will be better evaluated on a more developed factual record”). At this stage, at least, Plaintiff has plausibly alleged under North Carolina law that Defendant owed a duty of care apart from or in addition to its contractual obligations. Therefore, Defendant’s motion to dismiss the negligence claim should be denied. See generally Weddle, 2023 NCBC LEXIS 162, at *2–3.

Williams, 2024 U.S. Dist. LEXIS 58377, at *29–31.

54. This Court finds the analysis in Williams to be persuasive. Here too,

the Court has found that Plaintiff sufficiently pled the existence of a common law

legal duty of care owed by FastMed to protect her private information that is not

dependent on any existing contractual duty between the parties.

55. Nevertheless, FastMed argues that even if the economic loss rule does

not require dismissal of this action in its entirety, it should at least bar Plaintiff from

recovering her claimed economic damages because that category of damages (unlike

her emotional distress injuries) arises solely from her contractual relationship with

FastMed.

56. The Court concludes that this argument is premature for two reasons.

57. First, Plaintiff has not alleged the existence of a specific contract

between herself and FastMed. Moreover, even assuming such a contractual

relationship could be inferred generally from the allegations in the Complaint,

further factual development—through discovery—would be necessary to define the

contours of that relationship, particularly as it relates to Plaintiff’s claimed economic

damages. See, e.g., Greentouch USA, Inc. v. Lowe’s Cos. Inc., 2024 NCBC LEXIS 132,

at *13–14 (N.C. Super. Ct. Oct. 2, 2024) (concluding that “dismissal . . . under the

economic loss doctrine would be premature” in light of “the limited information before the Court at this early stage of the action”); Club Car, Inc. v. Dow Chem. Co., 2007

NCBC LEXIS 10, at *28–31 (N.C. Super. Ct. May 3, 2007) (deferring consideration as

to the possible application of the economic loss rule where it was “unclear whether

[plaintiff] ha[d] a contractual remedy”).

58. Second, the parties have not expressly briefed the issue of whether

North Carolina law permits the application of the economic loss rule so as to bar some

(but not all) categories of damages sought by a plaintiff where the doctrine would not

serve to bar the entire cause of action.

59. For these reasons, the Court declines to apply the economic loss rule to

any aspect of Plaintiff’s claims at the present time without prejudice to FastMed’s

ability to reassert this argument at a later stage of this litigation.

CONCLUSION

THEREFORE, IT IS ORDERED as follows:

1. FastMed’s Motion to Dismiss as to Plaintiff’s claim for violation of the

NCESA and her claims for negligence per se and invasion of privacy by

intrusion upon seclusion is DISMISSED as moot, and those claims are

DISMISSED with prejudice; and

2. In all other respects, FastMed’s Motion to Dismiss is DENIED.

SO ORDERED, this the 25th day of March 2025.

/s/ Mark A. Davis Mark A. Davis Special Superior Court Judge for Complex Business Cases